blackbox probe : x509: certificate signed by unknown authority even with insecure_skip_verify set to true

[Marion Guthmuller]

Hello!

I'm trying to monitor a website with prometheus and blackbox exporter. Each of them are running inside a docker (images pulled from official docker hub https://hub.docker.com/r/prom/prometheus and https://hub.docker.com/r/prom/blackbox-exporter/).

My prometheus config:

My blackbox config:

My issue:

The target that I'm trying to monitor is using a self-signed certificate. That's why I tried to set insecure_skip_verify: true but it doesn't seem to handle it. I have the following error in the probe debug:

ts=2020-08-26T10:09:33.988405182Z caller=main.go:119 module=http_2xx target=https://example.com level=error msg="Error for HTTP request" err="Get \"https://x.x.x.x\": x509: certificate signed by unknown authority"

What did I miss?

Thanks.

[Christian Hoffmann]

Hi,

On 8/26/20 1:26 PM, Marion Guthmuller wrote:
> I'm trying to monitor a website with prometheus and blackbox exporter.
> Each of them are running inside a docker (images pulled from official
> docker hub https://hub.docker.com/r/prom/prometheus and
> https://hub.docker.com/r/prom/blackbox-exporter/).
>
> My prometheus config:
>

> prometheus_config.png
>
> My blackbox config:
>
> blackbox_config.png
>
> *My issue:*

>
> The target that I'm trying to monitor is using a self-signed
> certificate. That's why I tried to set insecure_skip_verify: true but it
> doesn't seem to handle it. I have the following error in the probe debug:
>
> ts=2020-08-26T10:09:33.988405182Z caller=main.go:119 module=http_2xx

> target=https://example.com *level=error msg="Error for HTTP request"

> err="Get \"https://x.x.x.x\": x509: certificate signed by unknown

> authority"*

Can you confirm that you restarted blackbox_exporter after changing the
config? Comparing start time (ps) with config file modification time
(ls/stat) should be a good indicator.

I cannot think of any other reason why this wouldn't work. The config
looks right and the module name matches.

Kind regards,
Christian

[Marion Guthmuller]

Hello,

Thanks for your answer. I confirm that I restarted blackbox_exporter after changing the config ;-)

The only solution that I found is adding a volume into blackbox exporter docker which bind with the host certificates directory (it contains the self-signed certificate (/etc/ssl/certs) and it works! Not sure it's a good solution however...